> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuro-tech.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Run the trusted-backend sample

> Keep Agent API credentials server-side and show safe account data in a browser

This sample turns the verified Agent API login and `Account/Info` calls into a small browser application with a trusted Node.js backend.

<Info>
  The Agent API is Neuro's primary HTTP API. Its name is unrelated to AI agents: the application acts through the Neuron's Agent endpoint instead of connecting directly over XMPP and managing the corresponding private keys itself.
</Info>

## Architecture

```text theme={null}
Browser ──GET /api/account──> Node.js backend
                                  │
                                  ├─ POST /Agent/Account/Login
                                  └─ POST /Agent/Account/Info
                                             │
                                           Neuron
```

The backend receives the JWT and immediately uses it for `Account/Info`. The browser receives only an allowlisted projection of the result.

## 1. Open the project

After cloning this documentation repository, change into the sample directory:

```bash theme={null}
cd samples/trusted-backend-first-app
```

The project uses only Node.js built-ins. It does not require an install step or a package-manager lockfile.

## 2. Run the deterministic checks

With Node.js 20.6 or later:

```bash theme={null}
npm test
```

The tests use a fake HTTP transport. They verify the signature input, Agent API URLs and bodies, bearer-token placement, browser allowlist, security headers, and generic upstream-error response without contacting a Neuron.

## 3. Configure a development Neuron

Copy the environment template:

<CodeGroup>
  ```powershell PowerShell theme={null}
  Copy-Item .env.example .env
  ```

  ```bash macOS/Linux theme={null}
  cp .env.example .env
  ```
</CodeGroup>

Set these values in `.env`:

```dotenv theme={null}
NEURON_HOST=neuron.example.com
NEURON_USER=alice
NEURON_PASSWORD=<PASSWORD>
PORT=3000
```

`NEURON_HOST` is a host with an optional port. Do not include `https://` or a path. The `.env` file is ignored by Git.

## 4. Start the application

```bash theme={null}
npm start
```

Open `http://127.0.0.1:3000`, then select **Load safe account fields**. Success shows the username and available account timestamps. The source email address, phone number, password, and JWT never enter the browser response.

## Keep credentials on the backend

This sample deliberately:

* binds only to `127.0.0.1`;
* rejects a host containing a scheme, path, or whitespace;
* sends credentials only from the backend to the configured HTTPS Neuron;
* returns `Cache-Control: no-store` for JSON;
* applies a restrictive browser Content Security Policy;
* returns a generic `502` response when the Neuron rejects or cannot complete the request.

It is not a production login system. Before deployment, add an application-user session, authorization checks, CSRF protection for state-changing routes, bounded timeouts and retries, rate limiting, secret management, and structured redacted logging.

## Next

* Read [Build your first Neuro application](/get-started/first-application) for the persistence and workflow checkpoints.
* Review [What can I build?](/get-started/what-can-i-build) and choose a capability supported by your Neuron.
* Use the [Agent API reference](/neuron-api/api-reference/overview) for documented methods, fields, and response schemas.